Fuente: Wipo "IOT" The sensor calculates a breadth of a range of normal communications for each normal communication model of the IoT device. The sensor classifies a normal communication model having a breadth less than a predetermined value as a normal communication model of a stable model, and classifies a normal communication model having a breadth equal to or greater than the predetermined value as a normal communication model of an IoT device of an unstable model. Afterwards, the sensor detects an abnormal communication in the IoT device using the normal communication model of the IoT device of the stable type, and reconstructs a normal communication model of the IoT device of the unstable type using the feature quantity, among the feature quantities used by the normal communication model, that contributes to the detection of the abnormal communication to a predetermined value or more. The sensor analyzes an abnormal communication common to each of the IoT devices using an abnormal communication of the IoT device of the stable type detected using the normal communication model and an abnormal communication of the IoT device of the unstable type detected using the reconstructed normal communication model.